PortSwigger Web Security Academy: turning XXE into SSRF to reach the cloud metadata endpoint and steal the server’s IAM credentials.
Exploiting XXE to Perform SSRF
Posts for: #PortSwigger: XML External Entity Injection
Exploiting XXE to Retrieve Files
PortSwigger Web Security Academy: XXE in a stock-check XML endpoint, defining an external entity to read /etc/passwd off the server.